Gootkit Loader Exploits Vlc Player: A New Malware Threat

Gootkit Loader, a type of malware, has recently been discovered exploiting VLC Media Player, a widely used legitimate application, to deliver malicious payloads. This malware campaign, part of an SEO poisoning campaign specifically targeting the Australian healthcare industry, aims to deceive users by inserting false reviews and redirecting them to fake QA forums containing malware-infected resources. The Gootkit Loader malware employs hacked websites to inject malicious JavaScript scripts and sideloads malicious DLLs, such as msdtc.exe and libvlc.dll, to exploit VLC Media Player. In addition, the campaign utilizes Cobalt Strike beacons for further illicit activities, allowing remote operators to execute various tasks, including network scans, lateral movement, credential and file theft, and the deployment of additional malware payloads. Gootkit Loader is associated with ransomware infections and has previously collaborated with the REvil gang. This article aims to provide an overview of Gootkit Loader, its campaign and techniques, its impact and consequences, as well as prevention and detection methods.

Key Takeaways

• Gootkit loader malware is using VLC Media Player as a means to deliver malicious payloads.
• The malware authors sideload malicious DLLs, such as msdtc.exe and libvlc.dll, to exploit VLC Media Player.
• Gootloader launched an SEO poisoning campaign targeting the Australian healthcare industry, using false reviews and medical-related keywords.
• Gootkit loader is associated with ransomware infections and has collaborated with the REvil gang in the past.

Gootkit Loader Overview

The Gootkit loader malware, known for its collaboration with the REvil gang in 2020 and its association with ransomware infections, aims to gain initial access to corporate networks by exploiting the VLC Media Player and delivering malicious payloads. Different variants of Gootkit Loader have been observed, indicating the evolution of its techniques. The malware authors sideload malicious DLLs, such as msdtc.exe (renamed VLC Media Player) and libvlc.dll (detected as Trojan.Win64.COBEACON.SWG), to exploit VLC Media Player. This allows them to perform illicit tasks remotely, including network scans, lateral movement, stealing credentials and files, and deploying more payloads. The use of Cobalt Strike post-exploitation toolkit and beacons further facilitates their activities. It is important for organizations to be aware of these evolving techniques and implement robust security measures to defend against Gootkit Loader attacks.

Campaign and Techniques

During the campaign, threat actors employed various techniques to distribute and propagate the malicious payload, targeting the Australian healthcare industry through an SEO poisoning campaign and utilizing compromised websites to inject malicious JavaScript scripts.

The following techniques were used:

1. SEO poisoning techniques: The threat actors launched an SEO poisoning campaign to manipulate search engine results and increase the visibility of their malicious links. They inserted false reviews around search results, combined medical-related keywords with Australian city names, and posted links on legitimate websites to redirect users to the attackers‘ website.

2. Detection and prevention measures: To avoid falling victim to SEO poisoning campaigns, users should follow security advice from experts, use trusted sources for file downloads, and enable file extensions for better visibility of filenames. Additionally, caution should be exercised when dealing with files of dangerous extensions, and downloaded files can be uploaded to platforms like VirusTotal for malware analysis.

By employing these techniques, the threat actors were able to effectively distribute the Gootkit loader malware and gain initial access to targeted networks.

Impact and Consequences

Impacting the Australian healthcare industry, the SEO poisoning campaign employed by threat actors demonstrates the far-reaching consequences of their malicious activities. The campaign not only compromised the integrity of search engine results but also posed significant risks to the security of healthcare organizations. The deployment of Gootkit loader malware through VLC Media Player allowed the threat actors to gain initial access to corporate networks, enabling them to perform illicit tasks such as network scans, lateral movement, and stealing credentials and files. These actions can lead to severe damage, including data breaches, financial losses, and reputational damage. To mitigate the risks posed by such campaigns, organizations need to conduct thorough damage assessments, implement robust security countermeasures, and stay updated with the latest threat intelligence. Additionally, user awareness and adherence to security best practices are essential in preventing and mitigating the impact of such malware threats.

Preventing and Detecting Gootkit

To effectively prevent and detect the presence of the malicious campaign, organizations must implement proactive security measures and regularly update their systems and software to mitigate vulnerabilities that threat actors could exploit. Detecting Gootkit requires organizations to be vigilant and employ various indicators and countermeasures. Indicators of Gootkit activity may include multiple outbound connections to ports 389, 445, and 3268, which are commonly used for remote network share SMB and LDAP. Additionally, monitoring for the presence of suspicious files such as PSHound.ps1 and soo.ps1 can help in identifying Gootkit. To mitigate the risks posed by Gootkit Loader, organizations should employ robust security solutions that can detect and block malicious JavaScript scripts injected into legitimate websites. Implementing web filtering and scanning downloaded files using reputable antivirus software can also help in preventing Gootkit infections. Regular security awareness training for employees is crucial in educating them about the risks associated with downloading files from untrusted sources and clicking on suspicious links.

Collaboration and Ransomware

Collaboration between Gootkit loader operators and the REvil gang in 2020 has linked the Gootloader campaign with ransomware infections, highlighting the potential for devastating consequences. This collaboration reveals the evolving tactics of cybercriminals, as Gootkit loader, previously associated with search engine result poisoning campaigns, now plays a role in ransomware attacks. The collaboration with APT10 further underscores the sophistication of these operations. Gootkit loader serves as a gateway for initial access to corporate networks, leveraging its capabilities to perform illicit tasks such as network scans, lateral movement, stealing credentials and files, and deploying additional payloads. The use of Cobalt Strike post-exploitation toolkit and the hosting of Cobalt Strike beacons further heighten the risk, as Cobalt Strike is often a precursor to ransomware attacks. This collaboration demonstrates the need for robust security measures to detect and prevent such threats.

Frequently Asked Questions

What is the purpose of the SEO poisoning campaign launched by Gootkit loader malware?

The purpose of the SEO poisoning campaign launched by Gootkit loader malware is to manipulate search engine results and redirect users to fake QA forums containing malicious links. This campaign aims to infect users‘ devices with malware and gain initial access to corporate networks for illicit activities.

How does Gootkit loader malware abuse VLC Media Player?

VLC Media Player can be abused by Gootkit Loader malware by sideloading malicious DLLs, such as msdtc.exe and libvlc.dll. It is unclear if VLC Player can be patched to prevent exploitation, and it is unknown if other media players are vulnerable to similar attacks.

What are the risks associated with malicious JavaScript scripts used by Gootkit loader?

The risks associated with malicious JavaScript scripts used by Gootkit loader include the injection of these scripts into hacked websites, redirecting visitors to fake QA forums containing links to malware-infected resources. This allows Gootkit loader to exploit users‘ devices and evade detection by antivirus software, posing a threat to financial institutions and other organizations.

What are the common outbound connections made by Gootkit loader malware?

Gootkit Loader malware exploits vulnerabilities in popular software, such as VLC Media Player, by sideloading malicious DLLs. This allows the malware to gain initial access to corporate networks and perform illicit tasks. The potential consequences of a Gootkit Loader infection include network scans, lateral movement, credential and file theft, and the deployment of additional payloads.

What are the recommended security measures to prevent and detect Gootkit loader infections?

To prevent and detect Gootkit Loader infections, it is recommended to use trusted sources for file downloads, enable file extensions for better filename visibility, exercise caution with files of dangerous extensions, upload downloaded files to VirusTotal for malware analysis, and follow security advice from experts. Gootkit Loader malware exploits vulnerabilities in popular software, such as VLC Player, to deliver malicious payloads. The potential consequences of a Gootkit Loader infection include unauthorized network access, credential and file theft, deployment of additional payloads, and the potential for ransomware attacks.